docker-compose.app.yml

services:
  magic-cloudflared:
    image: cloudflare/cloudflared:2026.3.0
    container_name: magic-cloudflared
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}
      REAL_IP_HEADER: Cf-Connecting-Ip
    networks:
      - app
    depends_on:
      - magic-nginx

  magic-nginx:
    # Entrypoint uses `sed` to substitute `${NGINX_SERVER_NAME}` only (POSIX; no gettext).
    image: nginx:stable-trixie
    container_name: magic-nginx
    restart: unless-stopped
    ports:
      - 80:80
    environment:
      NGINX_SERVER_NAME: ${NGINX_SERVER_NAME}
    volumes:
      - ./nginx.conf.template:/etc/nginx/nginx.conf.template:ro
      - ./docker/nginx-entrypoint.sh:/scripts/nginx-entrypoint.sh:ro
    entrypoint: ['/bin/sh', '/scripts/nginx-entrypoint.sh']
    networks:
      - app
    depends_on:
      - magic-app

  magic-app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_TURNSTILE_SITEKEY: ${NEXT_PUBLIC_TURNSTILE_SITEKEY}
        NEXT_PUBLIC_MONERO_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_MONERO_APPLICATION_RECIPIENT}
        NEXT_PUBLIC_FIRO_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_FIRO_APPLICATION_RECIPIENT}
        NEXT_PUBLIC_PRIVACY_GUIDES_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_PRIVACY_GUIDES_APPLICATION_RECIPIENT}
        NEXT_PUBLIC_GENERAL_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_GENERAL_APPLICATION_RECIPIENT}
        NEXT_PUBLIC_ATTESTATION_PUBLIC_KEY_HEX: ${NEXT_PUBLIC_ATTESTATION_PUBLIC_KEY_HEX}
        NEXT_PUBLIC_SENTRY_DSN: ${NEXT_PUBLIC_SENTRY_DSN}
        SENTRY_ORG: ${SENTRY_ORG}
        SENTRY_PROJECT: ${SENTRY_PROJECT}
        STRAPI_CDN_HOST: ${STRAPI_CDN_HOST}
    container_name: magic-app
    restart: unless-stopped
    environment:
      NODE_ENV: production
      STAGING_MODE_ENABLED: ${STAGING_MODE_ENABLED}
      APP_URL: https://${NGINX_SERVER_NAME}
      DATABASE_URL: ${DATABASE_URL}

      NEXTAUTH_URL: https://${NGINX_SERVER_NAME}
      NEXTAUTH_URL_INTERNAL: http://localhost:3000
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      USER_SETTINGS_JWT_SECRET: ${USER_SETTINGS_JWT_SECRET}
      TURNSTILE_SECRET: ${TURNSTILE_SECRET}
      NEXT_PUBLIC_TURNSTILE_SITEKEY: ${NEXT_PUBLIC_TURNSTILE_SITEKEY}
      NEXT_PUBLIC_MONERO_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_MONERO_APPLICATION_RECIPIENT}
      NEXT_PUBLIC_FIRO_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_FIRO_APPLICATION_RECIPIENT}
      NEXT_PUBLIC_PRIVACY_GUIDES_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_PRIVACY_GUIDES_APPLICATION_RECIPIENT}
      NEXT_PUBLIC_GENERAL_APPLICATION_RECIPIENT: ${NEXT_PUBLIC_GENERAL_APPLICATION_RECIPIENT}
      NEXT_PUBLIC_ATTESTATION_PUBLIC_KEY_HEX: ${NEXT_PUBLIC_ATTESTATION_PUBLIC_KEY_HEX}
      NEXT_PUBLIC_SENTRY_DSN: ${NEXT_PUBLIC_SENTRY_DSN}

      STRAPI_API_URL: ${STRAPI_API_URL}
      STRAPI_API_TOKEN: ${STRAPI_API_TOKEN}
      STRAPI_CDN_HOST: ${STRAPI_CDN_HOST}

      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT}
      SMTP_USER: ${SMTP_USER}
      SMTP_PASS: ${SMTP_PASS}
      SES_VERIFIED_SENDER: ${SES_VERIFIED_SENDER}

      STRIPE_MONERO_SECRET_KEY: ${STRIPE_MONERO_SECRET_KEY}
      STRIPE_MONERO_WEBHOOK_SECRET: ${STRIPE_MONERO_WEBHOOK_SECRET}
      STRIPE_FIRO_SECRET_KEY: ${STRIPE_FIRO_SECRET_KEY}
      STRIPE_FIRO_WEBHOOK_SECRET: ${STRIPE_FIRO_WEBHOOK_SECRET}
      STRIPE_PRIVACY_GUIDES_SECRET_KEY: ${STRIPE_PRIVACY_GUIDES_SECRET_KEY}
      STRIPE_PRIVACY_GUIDES_WEBHOOK_SECRET: ${STRIPE_PRIVACY_GUIDES_WEBHOOK_SECRET}
      STRIPE_GENERAL_SECRET_KEY: ${STRIPE_GENERAL_SECRET_KEY}
      STRIPE_GENERAL_WEBHOOK_SECRET: ${STRIPE_GENERAL_WEBHOOK_SECRET}

      PRINTFUL_API_KEY: ${PRINTFUL_API_KEY}
      PRINTFUL_WEBHOOK_SECRET: ${PRINTFUL_WEBHOOK_SECRET}

      KEYCLOAK_URL: ${KEYCLOAK_URL}
      KEYCLOAK_CLIENT_ID: app
      KEYCLOAK_CLIENT_SECRET: ${KEYCLOAK_CLIENT_SECRET}
      KEYCLOAK_REALM_NAME: magic

      BTCPAY_URL: ${BTCPAY_URL}
      BTCPAY_EXTERNAL_URL: ${BTCPAY_EXTERNAL_URL}
      BTCPAY_API_KEY: ${BTCPAY_API_KEY}
      BTCPAY_STORE_ID: ${BTCPAY_STORE_ID}
      BTCPAY_WEBHOOK_SECRET: ${BTCPAY_WEBHOOK_SECRET}

      PRIVACYGUIDES_DISCOURSE_URL: ${PRIVACYGUIDES_DISCOURSE_URL}
      PRIVACYGUIDES_DISCOURSE_CONNECT_SECRET: ${PRIVACYGUIDES_DISCOURSE_CONNECT_SECRET}
      PRIVACYGUIDES_DISCOURSE_API_KEY: ${PRIVACYGUIDES_DISCOURSE_API_KEY}
      PRIVACYGUIDES_DISCOURSE_API_USERNAME: ${PRIVACYGUIDES_DISCOURSE_API_USERNAME}
      PRIVACYGUIDES_DISCOURSE_MEMBERSHIP_GROUP_ID: ${PRIVACYGUIDES_DISCOURSE_MEMBERSHIP_GROUP_ID}

      ATTESTATION_PRIVATE_KEY_HEX: ${ATTESTATION_PRIVATE_KEY_HEX}

      COINBASE_CDP_API_KEY_ID: ${COINBASE_CDP_API_KEY_ID}
      COINBASE_CDP_API_KEY_PRIVATE_KEY: ${COINBASE_CDP_API_KEY_PRIVATE_KEY}
      COINBASE_CDP_WEBHOOK_SECRET: ${COINBASE_CDP_WEBHOOK_SECRET}

      KRAKEN_API_KEY: ${KRAKEN_API_KEY}
      KRAKEN_API_SECRET: ${KRAKEN_API_SECRET}

      SENTRY_AUTH_TOKEN: ${SENTRY_AUTH_TOKEN}
      SENTRY_ORG: ${SENTRY_ORG}
      SENTRY_PROJECT: ${SENTRY_PROJECT}

      GEMINI_API_KEY: ${GEMINI_API_KEY}
    depends_on:
      - magic-postgres
    networks:
      - app

  magic-redis:
    container_name: magic-redis
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - app

  magic-postgres:
    image: postgres:16-alpine
    container_name: magic-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: magic
      POSTGRES_DB: magic
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - 'postgres_data:/var/lib/postgresql/data'
    networks:
      - app

volumes:
  postgres_data:

networks:
  app:
    external: true
    name: ${DOCKER_NETWORK_NAME}